pentest-review

name	pentest-review
description	Review pentest scan results and classify findings. Use when: 'review pentest', 'check scan results', 'what failed', 'any vulns found', 'pentest report'.
argument-hint	[target] [report-dir]
allowed-tools	Read Grep Glob Bash
effort	high

User Input

$ARGUMENTS

Purpose

Review completed scan results from pentest/reports/ (or suite/reports/). Does NOT run scans — use /pentest for that. Reads existing reports, classifies findings against the target YAML, and produces a structured review with fix recommendations.

Two-Harness Model

pentest-kit has two harnesses producing different output:

Harness	Output location	Format
Regression suite	pentest/reports/<target>/<timestamp>/	results.json, SUMMARY.md, modules/*.txt
HexStrike	hexstrike/logs/ + hexstrike/exploratory-report-r*.md	Markdown round reports

This skill handles regression suite reports. For HexStrike, read hexstrike/exploratory-report-r*.md directly.

Workflow

Step 1: Locate reports

ls -lt pentest/reports/<target>/
REPORT=$(ls -td pentest/reports/<target>/*/ | head -1)

Step 2: Quick triage

# Module summary
jq -r '.modules[] | "\(.module)\t\(.status)\tP:\(.pass) F:\(.fail) S:\(.skip)\t\(.duration)s"' \
  "$REPORT/results.json"

# All failures and warnings
jq -r '.findings[] | select(.tag == "FAIL" or .tag == "WARN" or .tag == "VULN") |
  "\(.module)\t[\(.tag)] \(.text)"' "$REPORT/results.json"

# Skipped tests
jq -r '.findings[] | select(.tag == "SKIP") | "\(.module)\t\(.text)"' \
  "$REPORT/results.json"

Step 3: Cross-reference target config

Read pentest/targets/<target>.yaml and classify each finding:

Classification	Meaning
NEW	Not in known_vulnerabilities
CONFIRMED	Matches an accepted_risks entry
REGRESSION	Matches something previously fixed
FALSE POSITIVE	Explained by architecture (document the reason)
INCONCLUSIVE	Rate-limited/timed out before check could run

Step 4: Diagnose skipped tests

For each [SKIP], trace the root cause:

• Missing endpoint_groups.<key> in target YAML? → configure the key
• Missing auth session? → check auth bootstrap hook
• Tool not installed? → ./setup.sh or start hexstrike-ai container
• Intentionally skipped by skip_modules: in target config?

Step 5: Tooling audit

Check for silent failures:

• Modules with all-zero counters (P:0 F:0 S:0) — ran but emitted no tags
• [SKIP] lines referencing unconfigured endpoint_groups — add the key to target YAML
• Tools scanning a WAF login page rather than the app (302 interference)

Report Format

## Pentest Review: <target>

**Report**: <dir>
**Modules**: N completed, N skipped

### Findings

| Severity | Finding | Module | Status |
|----------|---------|--------|--------|

### Skipped Tests

| Module | Reason | Impact |
|--------|--------|--------|

### endpoint_groups gaps (unconfigured SKIP blocks)

| Module | Missing key | How to fix |
|--------|-------------|------------|

### False Positives

| Finding | Reason |
|---------|--------|

### Fix Recommendations

#### Application changes needed
[List findings with specific fix suggestions]

#### Target YAML changes needed
[List missing endpoint_groups keys]

Rules

1. Use results.json first. Fall back to grep for legacy reports.
2. Classify every finding — cross-reference the target YAML.
3. Trace every skip — distinguish "no endpoint configured" (fix YAML) from "intentionally skipped" (accept).
4. Flag rate-limit masking: 429 preventing auth testing = INCONCLUSIVE, not PASS.
5. Always run the tooling audit — zero-counter modules hide blind spots.